chore: consolidate nightly hardening PRs into one reviewed change set

[brainsparker]

What this is

The open nightly hardening PRs include three near-identical copies of the MCP path guard and several stale branches. This branch merges the best version of each distinct improvement in one pass. All seven keepers merged with zero conflicts, and the full suite passes.

Included (7 PRs)

• fix: nightly hardening - symlink-safe MCP path validation #21 symlink-safe MCP path validation (supersedes fix: nightly hardening - MCP validate path boundary #13, fix: nightly hardening - MCP validate path boundary guard #20, fix: nightly hardening - MCP validate path boundary guard #22)
• fix: nightly hardening - yaml unsafe key guard #9 YAML unsafe key guard
• fix: nightly hardening - strict ISO date validation #18 strict ISO date validation
• fix: nightly hardening - strict skill config root validation #11 skill config root validation
• fix: nightly hardening - remote URL credential guard #19 remote URL credential guard
• fix: nightly hardening - fetch timeout clamping #15 fetch timeout clamping
• fix: nightly hardening - redirect-safe remote profile loading #10 redirect-safe remote profile loading

Not included: #6 (SSRF-safe remote profile loading) and #8 (remote content-type validation) no longer apply to current main, and #14 (symlink-safe skill config) is stale. The SSRF guard from #6 is the one genuinely valuable idea in that group and is worth regenerating fresh against main after this merges.

Validation

• Build clean (tsup), tsc --noEmit clean
• Full suite: 156 passed, 0 failed (145 existing plus 11 new tests arriving with these changes)
• Pushed via API as a single squashed commit; per-PR merge history exists locally but the GitHub App push path cannot preserve it

After merging

Close the 13 open nightly hardening PRs with a pointer to this one.